Detects non-allowlisted wget activity on Linux, macOS, and Windows endpoints by monitoring process start events. The rule reconstructs the full command line from process.args, then parses and normalizes the destination host from URLs or the final token for scheme-less wget invocations. It redacts sensitive command-line values (credentials, tokens, secrets) and excludes common benign destinations (localhost, private IPs, popular package registries, and cloud mirrors). Activity is aggregated by host and destination, then a single ES|QL COMPLETION (LLM) triage request is issued per host-destination pair. The LLM verdicts are treated as decision support: only true positives (TP) or suspicious (SUSPICIOUS) with confidence above 0.7 generate alerts. The rule surfaces contextual data (host, user, parent executable, command samples) and destination prevalence, then maps the result to ECS fields (event.outcome, message, etc.). It aims to reduce alert fatigue by identifying payload delivery, C2, or data exfiltration attempts via wget while filtering routine legitimate usage. The configuration includes setup guidance, false-positive considerations (e.g., CI/CD or infrastructure automation), and remediation steps for confirmed threats.